CHICAGO -- An Indiana woman says she has 26,500 reasons you should pay attention to what happened to her online bank account -- and don't let it happen to yours.

Somebody in Hawaii knows something about the money that started in the bank account of an Indiana woman, Target 5's Lisa Parker reported Wednesday night.

Video: Online Insecurity

"Nobody called me. Nobody ever questioned the transaction. And I only found out about it when I got my bank statement," Marci Shames-Yeakal told Target 5.

The transaction she referred to was $26,500 transferred from Shames-Yeakal's line of credit into her business account, then wired to Hawaii.

"They found out that the wire was sent to a bank in Hawaii, to an account in Hawaii, and then the next day, people went into that account and took the money and wired it out to Austria and it was gone," she said.

Gone for good.

Shames-Yeakal said she got that news in a letter from her bank, Citizens Financial Bank of Indiana and the south suburbs. Her Munster, Ind., branch told her that she had signed an agreement stating that the bank "will have no liability to you for any unauthorized payment of wire transfer using your password."

The same letter stated that the bank's "security procedures were commercially reasonable."

"The irony of all that is that they didn't do anything to protect us," Shames-Yeakal said. "They gave us a user ID and a password, and that's what they call their protection."

Parker said that the Indiana woman's story joins a growing number in which banks appear to be taking a hard line, putting the onus on consumers to prove that they didn't cause a security breach that led to online theft.

"It's really unfair to say, 'OK, now you have to prove a negative. You have to prove what didn't happen," said consumer attorney Clint Krislov.

Consumer advocates point to the increasing number of threats to online banking security, such as "phishing," those persistent and realistic e-mails from scammers posing as your bank; hackers; viruses that intercept passwords; and key loggers, the malicious software that silently takes a snapshot of all the strokes you type, including user IDs and passwords.

"We consumers, we don't know what protections we need until we've been fleeced," Krislov said. "And so you have to be as aggressive and as assertive as you can in finding out what your bank does to protect you."

Parker said that many consumers think that their money online is protected, much like their credit cards, which limit liability if they are stolen. But in the world of online banking, she said, the protections are very specific and somewhat narrow.

Regulation E, passed in Congress in part to encourage online banking, sets a consumer's liability:

$50 if a theft is reported within two days

$500 if reported within 60 days

60+ days and there is no guaranteed protection

Although Shames-Yeakal said she found her problem within 10 days, to her dismay Regulation E did not protect her because her account was a business one, not a personal one.

"Since all this has happened, I've learned that the bank could do a lot more and be a lot more aggressive in protecting assets," she said.

"We can search for your money, we can search for bin Laden. Chances are, we'll catch him first." -- consumer attorney Clint Krislov

And many banks are more aggressive, Parker said. Some have recently announced anti-fraud innovations, like biometric IDs, which scan your eyes or fingerprints; security fobs that rotate multidigit codes and online programs that require visual IDs to thwart Trojan viruses that hijack accounts.

"In this brave new banking world," Parker said, "it's the kind of protection aimed at keeping your money where you put it."

"Once it's outside the banking system and outside the country, it's gone," Krislov said. "We can search for your money, we can search for bin Laden. Chances are, we'll catch him first."

Citing privacy concerns, Citizens Financial would not comment for this report, even though Shames-Yeakal agreed to sign a waiver allowing the bank to talk about her case, Parker said.

There are two lessons taken from Shames-Yeakal's experience: Know what your bank has in place to thwart fraud and know you must regularly watch all of the activity in your online account. The quicker you catch discrepancies in personal accounts, the better chance you have of recovering your money.